Computing Groups and Unix Groups Administration
The procedures to create or delete a Computing Group or a Unix Group require the intervention of the
Service Desk. For complete instructions, please check the following help topics:
How to Create a Computing Group
How To Delete a Computing Group (or Merge Two Groups)
Once created, these groups can be managed through the standard E-Groups interface
(http://e-groups.cern.ch).
Each Computing E-Group has an associated administrators E-Group, named groupname-admins.
Example: Computing E-Group ZP has a corresponding administrators E-Group ZP-Admins
(see them live here)
The groupname-admins E-Group is static, and is managed by the groupname-admins group members themselves.
Management Tips
Static E-Group: manual editing
Group Administrators can edit the Computing E-Groups manually.
Adding a user by name can be done as soon as the user is registered in the HR / AIS application.
Dynamic E-Group: Automate the Computing Group membership
Using a dynamic criteria to fill a Computing E-Group will fully automate the membership generation.
Example: the ZP E-Group belonging to ATLAS could be automated using some criterion like
Experiment=ATLAS, along with some other criteria to ensure a proper membership.
Recommended solution: use static and a dynamic sub-groups for your Computing Group
As manually adding members will always be required, we strongly suggest to use sub E-Groups, dynamic and static.
Example: ZP E-Group could have 2 sub E-Groups, one ZP-Dynamic-members and one ZP-Static-members,
allowing both automation and exceptions.
User moving from one group to another (changing experiment)
In case a user is changing experiment, Group Administrators just need to remove the user from the old Computing
E-Group and add him/her to the new Computing E-Group (note that in case of dynamic Computing E-Groups the change
will be automatic).
The Account Management service will automatically change the gidNumber of the corresponding account to that of
the new group after some time (1 hour at most during normal service operation).
Please note that, if the user wants his AFS home directory and files group to be changed, he will have to
run a specific set of commands
as described here.
User member of multiple computing groups
A user can be member of more than one computing group. It is not necessary to remove an account from a computing
group before adding it to another.
In that case, however, the Account Management service will not change the account's gidNumber automatically,
as the account is entitled to have any of the two values for its gidNumber.
Users can change their primary computing group (i.e. the group that will determine the Unix group id of
the account) of their own accounts using the
CERN Resources Portal.